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Abstract 

The quality of image encryption is commonly measured by the Shannon entropy over the ciphertext image. How- 
ever, this measurement does not consider to the randomness of local image blocks and is inappropriate for scrambling 
based image encryption methods. In this paper, a new information entropy -based randomness measurement for im- 
age encryption is introduced which, for the first time, answers the question of whether a given ciphertext image is 
sufficiently random-like. It measures the randomness over the ciphertext in a fairer way by calculating the averaged 
entropy of a series of small image blocks within the entire test image. In order to fulfill both quantitative and qualita- 
tive measurement, the expectation and the variance of this averaged block entropy for a true-random image are strictly 
derived and corresponding numerical reference tables are also provided. Moreover, a hypothesis test at significance 
Qf-level is given to help accept or reject the hypothesis that the test image is ideally encrypted/random-like. Simula- 
tion results show that the proposed test is able to give both effectively quantitative and qualitative results for image 
encryption. The same idea can also be applied to measure other digital data, like audio and video. 
Keywords: Image Encryption, Shannon Entropy, Encryption Measurement, Image Randomness, Hypothesis Test 



1. Introduction 

Recently, the Wikileaks incident harmed many personal and governmental interests by publishing a series of pri- 
vate, secret and classified media. This incident again reminded people and governments the importance of information 
security, although information security is still a relative new word existing for a half century. About two decades ago, 
the first data encryption standard (DES), a block cipher based on a 56-bit key, lUl was published for binary sequences. 
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Since then, research on the sequence cipher published many excellent ciphers, including Blowfish IS] in 1993, Twofish 
||28]| in 1998 and advanced encryption standard (AES) |3 1 in 1998. Nowadays, these encryption algorithms still prevail 
and are used by thousands of people, organizations and companies. 

As the other side of the coin, cryptography analysis developed at the same time as data encryption.Many ciphers 
are considered to be insecure due to some undesired properties that are weak to some cryptography analysis. For 
example, DES is believed to be insecure as it is weak to the differential attack and the bruteforce attack ll34l . Many of 
these attacks, such as the frequency attack, ciphertext-only attack and known ciphertext attack are designed directly 
for weak ciphertext, which is not random-like. Therefore, the ability of generating random-like ciphertext is one of 
most crucial criteria for a secure cipher 

A main focus of testing the randomness of a ciphertext is its distribution. Ideally, this distribution of ciphertext is 
uniform, because a uniform distribution implies that the each symbol in ciphertext is equally important. As a result, 
the cipher is invulnerable to statistical attacks. Moreover, both the relationship between ciphertext and plaintext and 
the relationship between ciphertext and encryption key are very complicated and involved. These two properties, 
namely confusion and diffusion, were identified by Claude Shannon in his 1949 masterpiece paper Il30l . 

Conventionally, randomness tests are designed for binary sequences, for example the Koknogorov test Il32l . poker 
test ll32l . gap test |32|, autocorrelation test ll32ll . Shannon entropy [291, diffusion randomness test lfT6ll . etc. Moreover, 
the standard randomness tests FIPS 140-1 12| and 140-2||4l are also for binary sequences. However, these randomness 
tests are out of date for image encryption, because digital image is typically a two dimensional data rather than a one- 
dimensional binary sequence. More specifically, it is different from a one-dimensional binary sequence in two main 
aspects: the high information redundancy between neighbor pixels and the bulk data nature. On one hand, this implies 
that conventional binary sequence ciphers are not good for image data either for a low encryption efficiency ||39l or a 
relatively small block size for encryption. Many image ciphers have been researced, including chaotic system based 
image ciphers Il7l[l0l[l3l[l5l[l8l[l9l|23]|25l|27l[35l|3^ SCAN language based algorithms lUWl^, transform 

based algorithms ll24l[3n[38ll and others ll22ll . On the other hand, the distinctive characteristics of image data implies 
that the randomness tests designed for binary sequences are inappropriate for image data. As a result, randomness tests 
for these image ciphers are commonly done with respect to some specific attack(s) instead of testing the randomness of 
binary sequences. For example, histogram analysis j7lfT0lfT3l[]31[T8lfl^l2ai23llB1l27ll35lMll4]^ and Shannon 
entropy test ITTI ITOl |271 [36l l42l |43]| are designed to test the cipher security to statistical attacks; autocorrelation test 
Q Uni [T3] |22l |22l [37] |42] |43] is designed to test the cipher security to ciphertext, and the Unified Average Changing 
Intensity (UACI) and Number of Pixel Change Rate (NPCR) tests ll7l [T0l[T3ll22l[35ti37ll42ll43l are designed to test 
the cipher security to differential attacks. 

One major problem of these prevailing randomness tests for image ciphers is that these tests provide quantitative 
results rather than qualitative results. For example, in the Shannon entropy test, the entropy scores for ciphertext 
images A and B may be 7.9911 and 7.9912, respectively. Although ciphertext image B has a relatively higher entropy 
score than A, which implies that ciphertext B is more random-like than A, the most important problem is still unan- 
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swered: whether or not the ciphertext image(s) A, B or both are sufficiently random-like? In other words, whether a 
ciphertext is sufficiently random-like is the first priority question. As long as a ciphertext is sufficiently random-like, 
whether its entropy score is 7.9911, or 7.9912 makes no statistical significance of difference. 

1 . This measurement should consider the nature of image data, for example, the two-dimensional property and 
bulk data property. 

2. This measurement should be mathematically well defined and easily calculated. 

3. This measurement should be applicable to all kind of image encryption methods, including permutation cipher, 
substitution cipher, etc. 

4. This measurement should provide reference values from a true-random image, such that both the quantitative 
and qualitative results can be drawn for any given test image. 

It is clear that both conventional histogram analysis and Shannon entropy test lack properties 1), 3) and 4) and that 
autocorrelation analysis, UACI and NPCR attain the property 1) 2) and 3) while not 4). Some other image encryption 
quality/randomness measurements 112111401 also fail to include the property 4. 

In this paper, we proposed a Shannon entropy based randomness test for image encryption which attains all above 
four properties. Unlike other variants of Shannon entropy for image encryption Ell , our measurement is directly 
designed for image data and is well mathematically grounded. The proposed measurement uses information from 
local image blocks rather than the global image. More specifically, it defines the sample mean Hk of information 
entropies for K randomly selected non-overlapped image blocks within a test image. Both the theoretical mean hhi. 
and variance crl,, of this sample mean are derived from a true-random image, where the intensity of each pixel follows 
an independent and identical uniform distribution. Quantitative test results are obtained by comparing the actual Hk 
and the theoretical mean fin-^. Moreover, an a level of statistical hypothesis test is also given in the paper to give a 
qualitative test according to the Central Limit Theorem (CLT). The case of approximating as a Gaussian when 
K is insufficiently large is also considered by using the Berry-Esseen Theorem (BET). Randomness tests by using 
the block entropy test on commercial image ciphers ||5] |6l and image encryption algorithms ifTTl l38l are done with 
computer simulations. Simulation results validate the effectiveness of the test. 

The remainder of the paper is organized as follows: Section 2 discusses the preliminary backgrounds in the 
Shannon entropy, the CLT and the BET; Section 3 proposes the block entropy test for image encryption, derives 
the theoretical mean yU//., and variance cr^, from a true random image and develops a hypothesis test with a-level 
significance; Section 4 provides simulation results of testing randomness on image ciphers by using the block entropy 
test; and Section 5 concludes the paper. 
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2. Background 

2.1. Shannon Entropy and Properties 

In 1948, Claude Shannon first proposed the concept of Shannon entropy ||29l . Since then, the Shannon entropy 
has been widely used in a variety of information sciences. It measures the randomness and quantifies the expected 
value of the information contained in a message, usually in bit units. The Shannon entropy of a random variable X 
can be defined as Eqn. ([TJ, f ,■ is defined in Eqn. (j2]i where jc, indicates the /th possible value of X out of n, and P, 
denotes the possibility of X - Xj. 

n 

H{X) = H{P, , P„) = - 2 Pi logj Pi (1) 

(=1 

Pi = Pr{X = Xi) (2) 
The Shannon Entropy attains, but is not limited to, the following properties: 

1. Bounded: < H(X) < logjn 

2. Symmetry: //(P, , f 2, •■■) = HiPj, Pi,...) etc. 

3. Grouping: H(Pu ■.■,Pn) ^ H(Pi + P2,P3, ...,P„) + (Pi + PiWij^, j^) 

In the context of digital images, an image X of size M-hy-N can be considered as a system with L pixel intensity 
scales. For example, a 8-bit gray image allows L - 256 gray scales from to 255. Additionally, denote the number 
of pixels within image X at pixel intensity scale / as N(/). Then Pi - Pr(X - I) - i^(l)/MN. Finally, Eqn. ([TJ turns 
into Eqn. (|3]l in the context of image data. 

//(x) = -yp,iog2P, = y^iog,^ (3) 

This image entropy attains its maximum when a pixel's intensity is equally likely at any scale I as Eqn. Q shows. 

Po^Pi^ ...^Pi^ = Pl-2 = Pl-i = l/L (4) 

An ideally encrypted image is completely random and thus its entropy reaches the theoretical maximum log2 L. 
Since the image entropy is a quantitative measurement for {Pq, Pi, P^-i ), it is an equivalent test to the histogram 
analysis, which plots the distribution of P/ and is commonly used for security analysis in the image encryption litera- 
ture. 

2.2. Central Limit Theorem and Berry-Esseen Theorem 

Let Yi,Y2, ...,Y„ be a sequence of n independent and identically distributed observations on a random variable Y 
associated with a finite mean fi and a variance cr^. The Central Limit Theorem (CLT) states that the sample mean of 
these observations approaches the normal distribution with a mean fi and a variance cr^/n, as the number of samples n 
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increases. Mathematically, the CLT can be stated as Eqn. (jSj) shows. The most important merit of the CLT is that it is 
true even when the probability density function (PDF) of the random variable Y does not follow a normal distribution. 

Y„ - y — ~ N(fJ., — ), as n ^ oo (5) 

1=1 

Instead of using Y„, the random variable Z„ defined in Eqn. ^ is commonly used in hypothesis tests, where 
Z„ ~ W(0, 1) as n — > oo. The convergence in distribution implies that Eqn. (j?]) is held for arbitrary z € !R, where <l>(z) 
is the cumulative distribution function (CDF) of NiO, 1). Consequently, the statistical test designed on this Z statistic 
is called the Z-test, where Fz„{z) denotes the actual CDF of Z„. . 

_ Y„-n 

Ai - — — p (o) 

cr/ ^jn 

lim Pr{Zn < z) = lim Fz„(z) = <^{z) (7) 

n — >oo /7— >oo 

As a supplement to CLT, Berry-Esseen Theorem (BET) quantifies the rate at which this convergence to normality 
takes place. The theorem states that there exists a positive constant C, such that the BET inequality defined in Eqn. 
(|8]l holds for all z and n, where cr is the standard deviation of Y and p is defined in Eqn. (j9]l. 

\Fz.,{z)-<^{z)\<-^ (8) 

cr-' yjn 

p ^ E[\Y - < ^ (9) 

The BET tells that the difference between the CDF of the standard normal distribution and that of the n sample 
mean of a random variable associated with a finite mean yU and a variance cr^ differs by no more than the specified 
amount. The calculated values of the constant C was 7.59 lfT4ll in 1941. Over the years, this value has greatly 
decreased. So far the best estimate of C is found as C < 0.4784 IfTTl in 201 1, derived from the inequaUty Eqn. ( 10 1. 



0.33477(p + 0.429cr3) 

sup \Fz„{z) - 0(z)| < (10) 

z cr-' ^|n 

3. Information Entropy based Randomness Test for Image Encryption 

3.1. Ideally Encrypted Image 

Before designing a measurement or test for image encryption, the question of what is an ideally encrypted image 
has to be answered. Although there might be other answers, the ideally encrypted image in this paper is considered 
as a random-Uke image, which is not discernible from a true random image. In other words, we believe that the 
ideally encrypted image and the true random image have the same statistics. Indeed, this is the ideal case for image 
encryption, which encrypts the original image pixel information so well that one cannot differentiate the encrypted 
image from a true random image. However, sharing the same statistics does not imply that an ideally encrypted image 
is a true random image but some image very alike it. 
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Definition 1. True Random Image (Ideally Encrypted Image): 

If an image random field R of size M-by-N with L intensity scales satisfies the condition that V/ e [ 1 , M] and j e [ 1 , A^], 
the image pixel located at the ith row and jth column R(i, j) is an independently and identically distributed random 
variable with the discrete uniform distribution over to L-1, namely V pixel p & R, p ~ t([0, L - 1], then this image 
R is a random image of size M-by-N with L intensity scales. 

It is noticeable that a true random image R has a very flat histogram, a high Shannon entropy over the entire image 
and a very low autocorrelation coefficient between neighbor pixels. Moreover, any image block of a true random 
image R should also attain a high Shannon entropy. This is an assumption that is true but is omitted in randomness 
tests for image encryption. In other words, we believe that an image containing some image blocks with low Shannon 
entropy scores is not ideally encrypted/random-Uke, no matter how high its global Shannon entropy is. 

Fig. 1 shows an example why the additional local randomness constraints has to be included for testing random- 
ness in image encryption. The plaintext image of the rabbit is encrypted by some image cipher using block processing. 
Some image block, say ears of the rabbit, however, is encrypted by a weak key. From the color histogram, it is clear 
that such a weak does not influence the ciphertext distributions very much. Although such a weak key only leads to 
a limited amount of information leakage (only ears are recongized), it may completely divulge the information of the 
image (rabbit). 




Fig. 1: An image encryption example (1st row: plaintext image and its histograms for R,G,and B channels; 2nd row: ciphertext image and its 
histograms for R,G and B channels) 

Although the ciphertext histogram distributions contains some small 'bumps', the entropy of ciphertext is 7.99373, 
which is very close to 8, the theoretical upper bound of entropy for an 8-bit image. Therefore, a pure high entropy 
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tested on the entire image is insufficient to test whether the test image is ideally encrypted/random-like. In other 
words, the global entropy test does not satisfy the first measurement consideration, laid out in the introduction. 

3.2. Block Entropy Test for Image Encryption 

In order to measure the local entropy over image blocks rather than the global entropy, the block entropy test on a 
given encrypted image X is fulfilled as follows: 

• Step 1. Randomly select Yi,Y2, ...,Yk image blocks at size M-hy-N within X (L intensity scales) without 
overlapping 

• Step 2. V/ € { 1 , 2, K] calculate Shannon entropy H{Yi) via Eqn. (|3]l 



Step 3. Calculate the sample mean Hfc over these K block entropies via Eqn. ( 1 1 

HiY,) 



K 



(11) 





75000 T 6000 7.7000 7.S000 7 9000 8.0000 



(a) Input 



(b) Step 1 



(c) Step 2 



(d) Step 3 



Fig. 2: An example of the block entropy test 



Fig. 2 shows the three steps of block entropy test on the previous encrypted rabbit image. It is clear that the new 
block entropy test on Hk deserves considerations for testing image randomness, because: 

• Randomly selected and non-overlapped K regions over the entire image give a fair coverage on a two-dimensional 
image; 

• The compact definition of Hk ensures a light computational cost; 

• Hk is applicable to both permutation and substitution based encryption methods. 

In order to make Hk a meaningful statistic that can be used to judge the randomness in an image, //^ from the 
ideally encrypted image has to be derived. In the remainder of this section, the theoretical mean and variance of //^ 
are given as a function of the block size MN and of the number of allowed intensity scales L. 
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3.2.1. Theoretical Mean and Variance of H*^ 

In this section, Y is considered as an image block at size M-hy-N with L intensity scales from an ideally encrypted 
image. Then V/ e {1,2, ...,K} Yi is an observation of Y. Since none of two tested image blocks are overlapped, 
it is reasonable to assume they are independent as well. As a result, H(Y\),H{Y2), ..■,H{Yk) are independently and 
identically distributed about fH(Y), which is the PDF of H{Y). Hence, as long as K is sufficiently large, the theoretical 
mean and variance of //^ is linked to H{Y) via Eqn. (jsj. Therefore, the first task is to find the mean and the variance 
of H{Y). 

Lemma 1. Let N(0 be the number of pixels in Y at intensity scale I, then ^(1) follows a binomial distribution associated 
with MN trails with l/L success possibility, /.e.N(/) ~ !Bi{MN, 1 /L). 

Proof ■.■ Pr(p = l\p eY) = l/L 

.-. Pr(p + l\p € F) = (L - 1)/L 

.'. The random variable for a pixel p at intensity level I follows a Bernoulli distribution with success 

possibility l/L. 
.-. For a M-by-A^ image block Y, S(Z) ~ <Bi{MN, l/L), that is: 

Prmh -n)- (^-'>"""' 
rr(s\ii.) -n) - „,(jj^^_„), ^mn 

□ 

Corollary 1. Pr{P, = n/MN) = „,(Z:„), ^^"^T'" 

Proof ■.■ Pi = Pr{Y = /) = N(0/MA^ and N(0 ~ mMN, l/L) 

.-. Prim = n) = PriMN -Pi^n)^ Pr(P, = n/MN) = ^^^^^^ '-^^^ 

□ 

L-I 

Theorem 1. If ni ^ MN, then Pr(S(0) = no, N(l) = nj, S(L- 1) = nz.-i) = MA?!/(«o!...nL-i!L*'^) 

/=o 

Proof. Denote event of S(/) = j as E'. . 

•.• Lemma 1 holds for an arbitrary scale Z e {0, 1, L-1) 
.-. Prim) = no, S(l) = «i, N(L - 1) = «n) 

= Pr(£;;°,L;",...,L^':j') 

= Pr(£«°)-Pr(£';',...,£«ti'|£o°) 

= PK^o") ■ PriE";) ■ PriE"^, ...,E"j^:l\El\E'{') 

= PriE"^:l\El\E'l\...,E"^:l) ■ UPriE"^^) = 1 ■ ff 

i=0 !=0 

(MiV-E«,)! "■v-i„"j 
^ j-j i'« (L-i-l) 

/=() n,!(MiV-y n,)! MN-'l ,,^ 
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_ MN<. (L-l)""-"0 (MN-no)\ (L-2)"''-"o-"i (>1z,_2+hl-i )! (1)"^-' 

no'.(MN-n(,V. L"" ' n,i.(MN-no-n,y. (L-l)""-"o ••■ ni-i'-iiL-i'. 2"t-2+"t-l 
_ MNI. 1 

no!...nL-i! i"" 

□ 

Remark 1. Theorem[T|can be directly used to calculate H(Y). Because the joint distribution of /(S(0), S(l), , S(L - 1)) 
is given and VZ e {0, 1, L- 1), 3P/ = S(Z)/MA^, the joint distribution of /(Pq, ^"1, ^"£-1)) is also known. Therefore, 

L-l 

the distribution of information entropy of an image block H{Y) - - Pi log2 ^le also obtained. 

/=o 

Corollary 2. IfY is a binary image, namely L — 2, then Theorem^degrades to 

PKN(O) = no, = ni) = MA^!/(«o!ni !2'^^) 

Proof. Straightforward. □ 

Because the statistics of interest are the mean and variance of H{Y) but not its distribution, an easier way to derive 
them is to first find h{Pi) in Eqn. ( [T2] i and then to calculate the mean and variance of H{Y) via Eqn. ( [T3] l. 



(12) 



L-l 



H{Y)^Y,^(Pi) 

1=0 

Using Corollary [Tjand Eqn. ( 12 1, the following expectation values can be obtained 

MN MN\{L-\)^^-" 



MN 



E[h{P,)] = V — l0g2 r 

MN n n\ 



n=0 
MN 



MN n n 



«=() 



(MN -ny.L^'^ 

MN^2 MN\(L - l)MN-n 
(MN -n)\L'^N 



MN MN-n, 



£ /j(P/,)/l(P/,) = > > (—— log2 )(— — log2 ) ■ , —TTTT^ 

r^Q "2 niln2\(MN - ni - n2y.L^" 



(13) 

(14) 

(15) 
(16) 



Therefore, //(F)'s first and second moments, mean fiH and ^[//(y)^] , can be obtained via Eqns. (17 i and (18i, 
respectively. Finally, its variance <t^ can be obtained via Eqn. ( 19 1. 

L-l L-l 



tiH = E[H(Y)] = /z(P,)] = 2 " ■ ^^^^^'^^ 



(17) 



/=() 



/=() 



L-l 



E[H(Yf] = £[(2/2(P,))2] 



/=o 

L-l 



= E[J]h(P,f + J] 2 /<n)M^/2)] 

Z=0 h=0 l2=Q,l2*li 

- L ■ £[/i(P,)2] + L(L - 1) ■ £[/z(P,, )/z(P,J] 



(18) 
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al = Var[H(Y)]^E[H(Yf]-E[H(Y)f 

= L ■ E[h(Pif] + L(L - 1) ■ E[h(P,,MP,^)] - ■ E[h(P,)f 



10 



(19) 



Therefore, an image block Y at size M-by-A^ within an ideally encrypted image X with L scales has the mean and 



variance of Shannon entropy as Eqns. ( 17 1 and ( 19 1, respectively. It is clear that //// and cr^ are determined as long as 
the size of MN and the number of allowed scales L are specified. 



= E[H*^] = E[J^ H(Yi)]/K = ^iH 

1=1 

K 



(20) 
(21) 



Based on //// and cth, the theoretical mean and variance of H*^, can be obtained as Eqns. ( 20 1 and ( 21 1, respectively. 
Once a test encrypted image is given and the block entropy test is applied, the actual sample mean Hk is obtained. 
If the test image is ideally encrypted, then this actual sample mean should be comparable with the theoretical sample 
mean hh'^, which is derived from the ideal case. Otherwise, the actual sample mean Hk should be lower than hh-^. 

3.2.2. Numerical Mean and Variance of H*^ 



Numerically, the mean and variance of H{Y) can be calculated via Eqns. ( 17 1 and ( 19 1 as Table 1 shows. Conse- 
quently, the mean and variance of H*^ are obtained via Eqns. (20i and (21 1 according to the used number of sample 
blocks K. 

Table 1: Numerical Results of fin and cth of a image block encrypted by an ideal cipher 





Binary Image: L = 2 


Gray Image: L = 256 


size M-by-N 








o-H 


2-by-2 


0.7806390622 


0.3077153752 


1.9883002343 


0.0760641186 


4-by-4 


0.9533616074 


0.0661878066 


3.9420646175 


0.0828513507 


8-by-8 


0.9886389750 


0.0160692363 


5.7657169289 


0.0766034388 


16-by-16 


0.9971767038 


0.0039927774 


7.1749663525 


0.0524379986 


32-by-32 


0.9992952146 


0.0009967175 


7.8087565712 


0.0172463431 




Binary Image: L = 2 


Gray Image: L = 256 


size M-by-N 








"k 


2-by-2 


0.7806390622 


0.30771 53752/ Va: 


1.9883002343 


0.076064 11 86/ 


4-by-4 


0.9533616074 


0.0661 878066/ a/^ 


3.9420646175 


0.082851 3507/ 


8-by-8 


0.9886389750 


0.0160692363/ Va: 


5.7657169289 


0.0766034388/ a/^ 


16-by-16 


0.9971767038 


0.0039927774/ ^ 


7.1749663525 


0.0524379986/ 


32-by-32 


0.9992952146 




7.8087565712 


0.017246343 1/V^ 



From Table 1, it is clear that as the size of test block MN increases, the expected block entropy increases quickly 
towards to its theoretical upper bound, while the variance of block entropy decreases quickly towards to zero. This 
conclusion is not surprising, because the intensity scale for each pixel is assumed to follow an uniform distribution 
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1/(0, L - 1), so the more pixels in the test block, the higher the block entropy. Meanwhile, the intensity scale for each 
pixel is also assumed independently distributed, so the variance tends to decrease as the sample size increase. It is 
clear that if a test image has a high block entropy when the block size is small, it tends to have a higher entropy when 
this block size increases. However, the opposite claim does not always hold: a high entropy with a large block size is 
not necessary to imply a relative high entropy when this size decreases. 




(a) Pattern (b) Scene (c) Random (d) Block Entropy Comparison 

Fig. 3: Sample Images with Block Entropy Comparison 

Fig. 3 shows three images, namely 'Pattern', 'Scene' and 'Random' with their block entropy results. It is obvious 
that the tendency of Shannon entropy is ascending as the block size increases. Although 'Pattern' reaches the upper 
bound of Sharmon entropy at the block size of 256-by-256, its block entropy at smaller size is far lower than the other 
two test images. This result shows another example of why it is inappropriate to use global entropy for testing image 
randomness and thus for measuring image encryption quality. 

In addition, from the comparison results in Fig. 3-(d), it is noticeable that the block entropies of three test images 
get closer as the block size increases. On the other hand, from Table 1, too small block size may not be large enough 
to test the entropy. For example, a size of 2-by-2 block is obviously small for testing the entropy in a gray image, 
which has 256 intensity scales. Therefore, in order to obtain a good test results, an appropriate block size has to be 
determined. 

Heuristically, we believed that MN = 256 is a good block size for gray image L = 256. In the following section, 
the Z-test on Hk is derived for L - 256 and MN - 256. 

3.3. Z-Test on Hk 

Conventional quantitative measurements are commonly not easy to follow. For example, how flat a histogram of 
the ciphertext is 'flat' enough? Is an entropy of 7.9999 close enough to the theoretical upper bound 8 or is 7.991 1 the 
value that should be believed to be close enough? Therefore, it is desired to make a qualitative measurement rather 
than a quantitative for these cases. This section introduces a qualitative measurement for image randomness using the 
Z-test. 

With results derived from an ideally encrypted image, we know that the sample mean H*^, of Shannon entropy on 
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K image blocks follows the normal distribution N{iJ.H'f.,cr^. )■ However, in reality, the actual sample mean Hk may 
or may not follow the ideal distribution. Without loss of generality, suppose the true mean of the block entropy for a 
given image is fi,^si- Therefore, the hypotheses, then, are: 

• Null Hypothesis 'Hq: ^test - IJ^h], (the test image X is ideally encrypted) 

• Alternative Hypothesis 'T/i : yU,^ „ < hh- (the test image X is not ideally encrypted) 



Define the Z statistics for block entropy test as Eqn. ( 22 1 shows. 



(22) 



We interested in two things: (1) the critical value He such that V//^ < He we reject 'Hq and VHfc > He we accept 
'Hq; and (2) the error rate of rejecting TYo when 'Ko is true, which is called Type I error with the definition in Eqn. 
(23 1. It is clear that these two things are closely related for the smaller He is used the smaller a is. Statistics tells us 



that given an a level of significance, the critical value He can be found via Eqn. ( 24 1, where K is sufliciently large 

a - Pr{ reject 'HqI'Mq is True) 
He^ ^lHl-^~\a)■ ar„.^ 



(23) 
(24) 



For any given a, a corresponding critical value He can be calculated via Eqn. (24 1. Table |2] shows critical values for 
deciding whether a test image is ideally encrypted or not when the block size 16-by-16 and L - 256. 

Table 2: Critical Values of Hypothesis Test for Image Encryption (MN = 256 and L = 256) 





K = 36 


K = 49 


K = 64 


A- = 81 


K = 100 


a = 0.05 


7.1605908805 


7.1626445194 


7.1641847485 


7.1653827045 


7.1663410693 


a = 0.01 


7.1546348481 


7.1575393487 


7.1597177242 


7.1614120162 


7.1627674499 


a = 0.001 


7.147958753 


7.1518169815 


7.1547106529 


7.1569612862 


7.1587617928 




K = 121 


K= 144 


K = 169 


K = 196 


K = 225 


a = 0.05 


7.167125186 


7.1677786165 


7.1683315193 


7.1688054359 


7.1692I6I637 


a = 0.01 


7.163876441 


7.1648006003 


7.1655825813 


7.1662528506 


7.1668337508 


LY = 0.001 


7.1602349346 


7.1614625528 


7.1625013066 


7.163391667 


7.1641633127 




K = 256 


A- = 289 


A- = 324 


K = 361 


= 400 


a = 0.05 


7.1695755505 


7.1698926565 


7.1701745285 


7.1704267298 


7.1706537109 


a = 0.01 


7.1673420384 


7.1677905274 


7.1681891844 


7.1685458774 


7.1688669012 


CY = 0.001 


7.1648385027 


7.1654342586 


7.1659638193 


7.1664376369 


7.1668640727 



It is worth while to note that the Eqn. ( 24 1 holds only for a sufficiently large K. In other words, if the CLT is 



not satisfied, then Eqn. (24 1 is inaccurate. Therefore, the last question for the proposed hypothesis test is when K is 
sufficiently large such that the CLT can be appUed. Unfortunately, this is a controversial question. Many statisticians 
believe that if the sample size is larger than 30 then K is sufficiently large ||33lll26l , but some others suggest other 
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sample sizes ll20l . for example 100 lOj. If the sample size K is considered to be sufficiently large, the contents in Table 
|2]can be directly used. 

A safer way to check how good or bad critical values in Table |2] are is to apply the BET, which gives error bounds 



of approximating the sample mean with the standard normal distribution. Recall Eqn. (10 1, the value of pjcr' in our 
problem is found about 1.6 by using the Monte Carlo simulation for 100,000 trails. Substitute this value and the upper 



bound of C, Eqn. ( 25 1 is obtained 



WzM) - ^ 0.76544/ 



(25) 



With the BET, even if the sample size K is not large enough to apply the CLT, it is still possible to use the CLT 
conclusion to estimate the sample mean. Because for any given value He associated with an a in Table |2j Eqn. p6] l 



always holds. As a result, the true type I error y of the hypothesis test for image encryption is obtained in Eqn. (27 1 



<D(z < = a (26) 

^ ^ He -mi, 0.76544 He-HHi, 0.76544 
7^Fz,{z< ^)< ^+<D(z< ^)= (27) 

Table [3] shows the y values corresponding to the critical values in Tabel|2] From the results, it is clear that the upper 
bound of Type I error when approximating the sample mean of block entropies with a normal distribution gets smaller 
as the sample size increases. Moreover, this upper bound tells how bad the proposed hypothesis test could be. For 
example, the critical value for a - 0.01 and K - 100 is //^ = 7.1627674499 in Tabel[2] The corresponding y for 
a - 0.01 and K - 100 is y = 0.08654. Therefore, in the worst case, the possibility to reject 'Ko when it is true is 
0.08654. It is worth to note that 0.08654 is the upper bound, which may not be actually reached. More likely, the CLT 
is applicable to this case and thus the error rate is 0.01. 



Table 3: Upper Bounds of Type I Error y for the Block Entropy Test 





a: = 36 


a: = 49 


a: = 64 


a: = 81 


K = 100 


a = 0.05 


0.17757 


0.15935 


0.14568 


0.13505 


0.12654 


a = 0.01 


0.13757 


0.11935 


0.10568 


0.09505 


0.08654 


a = 0.001 


0.12857 


0.11035 


0.09668 


0.08605 


0.07754 




K = ni 


A:= 144 


a:= 169 


K= 196 


a: = 225 


a = 0.05 


0.11959 


0.11379 


0.10888 


0.10467 


0.10103 


a = 0.01 


0.07959 


0.07379 


0.06888 


0.06467 


0.06103 


a = 0.001 


0.07059 


0.06479 


0.05988 


0.05567 


0.05203 




a: = 256 


a: = 289 


if = 324 


if = 361 


a: = 400 


a = 0.05 


0.09784 


0.09503 


0.09252 


0.09029 


0.08827 


a = 0.01 


0.05784 


0.05503 


0.05252 


0.05029 


0.04827 


a = 0.001 


0.04884 


0.04603 


0.04352 


0.04129 


0.03927 



4. Simulation Results 
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Previous sections have already set up the block entropy test for image encryption. In this section, it is applied to 
measure the randomness of encrypted images both quantitatively and qualitatively. 

4.1. Measure the Quality of Image Shuffling 

Conventional image shuffling algorithms are very popular in encryption community for their compactness and 
fast encryption rate. Although simply shuflBing pixels is insecure from the view point of cryptanalysis, the objective 
of this example is show how to use the block entropy test for measuring the quality of image shuffling, which is an 
impossible task for the global entropy test. 



Generally speaking, a pixel-wise shuffling algorithm for image encryption is defined in Eqn. ( 28 1, where S (i, j) 



indicates the pixel located at intersection of the /th row and the jth column in the shuffled image S ; e[[ is a permutation 



for the row number and the column number. If additionally Eqn. ( 29 1 holds, i.e. ej^ is a function separable with respect 
to the row variable and the column variable, then a pixel-wise shuffling degrades to a row-column-wise shuffling. As 
its definition implies, a shuffling algorithm does not change the intensity level for any pixel, but shuffles the positions 
of pixels. A shuffling algorithm can also be block cipher, which shuffles a certain size of image block at one time for 
fast computation. 

S{i,j)^I(e'-^{i,j)) (28) 



[en(ile'=nU)]^e'-^ii,i) (29) 

Fig. 4 shows examples of image encryption using shuffling algorithms. For simplicity, a shuffled image / using 
pixel-wise shuffling scheme with a M-hy-N block sizeis denoted as S'^^^^(I). Similarly, a shuffled image using the 
row-column-wise scheme is denoted as S'^_^^^^,(I)- The original image is the binary logo image of Tufts University at 
size of 256-by-256. It is noticeable that the row-column-wise shuffled images have a mesh-like pattern because the 
pixels are shuffled with respect to a row-wise shuffling followed by a column-wise shuffling. In other words, pixels in 
a row/column are still in a row/clumn after shuffling and the only difference is that the row/column number of these 
pixels are changed after shuffling. From this series of images, it is noticeable that from the point view of human visual 
inspection: 

• S'^^'^(I) gets more random-like as M xN increases 

• >Sjf4'^(/) is more random-like than ^Sf^^'^^C/) 

It is clear that testing the Shannon entropy with respect to the global image is ill-posed to measure the randomness 
of a shuffling based encryption algorithm, which does not change the image global statistics. Alternatively, the FIPS 
140-2 tests for binary sequences and the block entropy test are used to test the randomness of images in Fig. 4. 



/Information Sciences 00 (2013) /- |23| 



15 




(a) Original Image I 







(d)^">f(/) 
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(f) 



(h) ^I^f^^-* (/) 



Fig. 4: Image shuffling for the binary Tufts logo 
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(a) Tendency of T = mbits/#lbils 



16-by-l6 32-ljy-32 64-liy-fi4 

(b) Tendency of /fioo 



Fig. 5: Randomness Test for Image Shuffling 
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Table 4: Randomness Test for Binary Images in Fig. 4 



Comparison 


FIPS 140-2 Tests 


Block Entropy Test 




Monobit 


Poker 


Run 


Long 














Length of The Run 
















1 


2 


3 


4 


5 


>=6 


Run 


Mean 


Std 


Theoretical Value 


9725-/072J 


2.16-46.17 


2315-2685 


1114-1386 


527-723 


240-384 


103-209 


103-209 





0.9971767 


0.0003993 


/ 


Obit 


11299 


2913.984 


106 


131 


109 


36 


42 


280 


110 


0.4576711 


0.3697290 




1 bit 


8701 




53 


70 


59 


54 


73 


395 










Obit 


11244 


2386.291 


1371 


530 


292 


137 


101 


285 


82 


0.5498039 


0.3324658 




] bit 


8756 




1238 


565 


309 


169 


84 


352 










Obit 


11251 


695.8784 


1774 


830 


499 


239 


184 


461 


7 


0.6660959 


0.3168008 




1 bit 


8749 




2232 


828 


370 


199 


113 


246 










Obit 


9411 


869.2224 


2354 


1050 


512 


263 


155 


218 





0.7723314 


0.2896868 




1 bit 


10589 




2105 


I1I2 


550 


298 


165 


323 










Obit 


5872 


4582.874 


2897 


856 


259 


79 


26 


6 





0.8728581 


0.0552799 




1 bit 


14128 




1174 


862 


592 


458 


315 


722 










Obit 


11235 


2802.157 


1137 


348 


146 


114 


26 


222 


97 


0.5399521 


0.3266322 




1 bit 


8765 




857 


481 


190 


122 


43 


301 










Obit 


11179 


822.0224 


1457 


476 


212 


138 


67 


339 


83 


0.6431998 


0.3261251 




1 bit 


8821 




1259 


610 


157 


190 


119 


355 










Obit 


9917 


377.1584 


1535 


600 


302 


115 


112 


348 


57 


0.7548611 


0.3052360 




1 bit 


10083 




1476 


574 


338 


109 


139 


375 










Obit 


5370 


10966.144 


1957 


714 


384 


79 


56 


34 





0.8508929 


0.1121833 




] bit 


14630 




1075 


752 


449 


269 


156 


524 
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Although the binary Tufts logo is not random and neither are any of its shuffled versions, the objective of applying 
these two set randomness tests is to investigate whether some test randomness score(s) could be meaningful in the 
sense of coinciding with the randomness tendencies observed by using human visual inspections. The results of FIPS 
140-2 tests and the proposed block entropy test are shown in Table |4] It is worthwhile to note the required binary 
sequence length for FIPS 140-2 tests is 20,000. In our tests, a rectangular region of interest (ROl) at size of 100-by- 
200 is randomly selected for each test image, then the test binary sequence is extracted one by one from this ROI and 
is tested with FIPS 140-2 randomness tests. Meanwhile, the size M-hy-N for the block entropy test is set to 16-by-16 
and the sample size K is 100. 

From the column of 'Block Entropy Test' in Table |4j it is clear that the block entropy test scores matches our 
expectation of image randomness from the point view of human visual inspection. Although one statistic T, the ratio 
of the number of bits to the number of 1 bits, roughly supports the two conclusions, this ratio is indirect and implicit 
in the randomness test of Monobit. Unless the ratio T of the original binary 'Tufts' logo is known as 0.41, it is hard 
to draw conclusions simply by looking at Fig. 5-(a). However, the two conclusions are pretty obvious with results of 
the block entropy test as Fig. 5-(b) shows. 

From this example, it is clear that the proposed block entropy test is applicable to image shuffling problems as well 
and the test score indicates the averaged randomness of the shuffled image. A higher block entropy test score implies 
a higher randomness for local image blocks and thus a better shuffling quality. Compared to conventional randomness 
test tools for binary sequences, the block entropy test is more robust for testing image randomness. Meanwhile, the 
test scores do match results from human visual inspections. 

4.2. Test the Randomness of Image Encryption 

In this example, the block entropy test is applied to images encrypted by five image ciphers, including Blowfish 
(HI, AES G], Twofish 1281, 3DCat Qll and Sudoku ||38] ciphers. Blowfish, AES and Twofish ai-e well-known block 
ciphers designed for binary sequence encryption and are still the prevailing encryption methods even if they are not 
designed for digital images. Commercial ciphers 15] El implemented Blowfish, AES and Twofish algorithms are used 
in this simulation. '3DCat' refers to the image encryption method based on chaotic sequences generated from 3D 
chaotic cat maps. 'Sudoku' refers to the Sudoku image cipher, which employs the Sudoku matrix in conventional 
substitution and transposition ciphers. Images encrypted by using '3DCat' and 'Sudoku' are realized by using the 
original codes. The USC-SIPI 'Miscellaneous' image set is selected as our plaintext image set. Computer simulations 
are done under Windows XP environment with MATLAB R2010a. 

Fig. 6 shows the total 28 test plaintext images covering a wide collection of image contents, scenes and patterns. 
These images are all gray with a size from 256-by-256 to 1024-by-1024. It is obvious that some man-made images 
in the plaintext image set are very challenging for encryption. For example, 'ruler512.tif' is a gray image, but it 
is more similar to a binary image containing only black and white. Meanwhile, it has mesh-like patterns and large 
homogenous regions. All these properties imply that this image has a very tilted histogram with high correlations 
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5.1. OS .tiff 5.1.10.tiff 5.1 .11 .tiff 5.1.12.tiff 5.1.13.taf 5.1,14.tiff 5.2.08"tiff 




7.2 .01. tiff boat512.tiff elaiiie512.tiff gmy2L512.tiff mimbeis.512.tiff nilei.512.tiff testfallk.tiff 



Fig. 6: Test Images from USC-SIPI 'Miscellaneous' Image Dataset 

between rows, columns and image blocks. As a result, this image is considered as a hard case for image encryption. 

In the following test, the 28 plaintext images first are encrypted by mentioned ciphers and then the block entropy 
test is applied to each encrypted image. It is worthwhile to note that related parameters are: 

• The block size used in test is 16-by-16, i.e. MN - 256 

• The number of intensity scales is 256, i.e. L - 256 

• The number of samples is 100, i.e. K - 100 

Therefore, the theoretical distribution under "Ko, the critical values associated with a - 0.01 and 100 samples in the 
hypothesis tests, and the corresponding upper bound of Type I error are: 

• Theoretical distribution under "Ho: Hioo ~ MiUH- , cr?,, ), where u^- = 7.1749663525 and o-^- = 0.00524379986 
(See Table 1) 

• Critical value: He = 7.1627674499 with a = 0.01 and 100 samples (See Tableji]), if Hm < He then we say the 
test image is NOT ideally encrypted. 

• Upper bound of Type I error when 100 is not considered as sufficiently large: y - 0.08654 (See Table |3]l 

Table 5 shows the block entropy test for images including original test images in Fig. 6 and encrypted images 
by mentioned ciphers. Data visualization for block entropy test results are provided in Fig. 7 (regions above He is 
shaded). From this Table, it is easy to see that images encrypted by block ciphers for binary data tend to have a much 
lower mean i/ioo than those encrypted by image ciphers. On the other hand, /fioo for image ciphers are around 
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with much smaller standard deviations than those of block ciphers for binary data. This result support the claim that 
block ciphers for binary data are inappropriate to encrypt image data | 



Moreover, the i/joo s that below He = 7.1627674499 are marked with '*' in Table 5. The number of times of 
rejecting "Ho for tested ciphers, denoted as #R, are listed in the table. According the total number of images T = 28 
with a - 0.01 and y - 0.08654, we know that: 

• If the tested cipher is ideal and K = 100 is sufficiently large, then the expected #R for a 28-image test equals 
Ta = 0.28. In other words, for any cipher which has a number of rejections bigger than 1, it is NOT ideal. 

• If the tested cipher is ideal and K - 100 is NOT sufficiently large, then the upper bound of the expected #R for 
a 28-image equals Tj - 2.42. In other words, for any cipher which has a number of rejections bigger than 3, it 
is NOT ideal. 

Therefore, based on this knowledge, all tested block ciphers for binary data do not generate ideally encrypted images 
for image data. '3DCat' cipher is a borderline because if the sample size is considered to be sufficiently large, then 
it is not of a type of ideal cipher which always generates ideally encrypted images, otherwise it is. 'Sudoku' cipher 
always give random-like ciphertext in this 28-image test and thus no evidence to reject that 'Sudoku' cipher is an ideal 
cipher for image data. 



7.20 
7.1! ■ 
7.16 
7.14- 
7.12 ■ 
7.10 ■ 
7.0! ■ 
7.06 
7.04 
7.D2 
7. DO ■ 



He - 7.16276 74499 



I 



TwoFish 



3DCal 



Sudoku 



7. 2D 
7. IS 
7.16 
7.14 
7.12 
7.10 
7.QS 
7.Q6 
7.Q4 
7.02 
7.00 



■ 5,l,03.tiff 

■ 5 1 lO.tiff 
-! 5 1 ll.tlff 

■ 5,l,12.tiff 
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P 5,3,01.tiff 

■ 5,3,02.tiff 

■ 7 1 Ol.tif 

■ 7 1 02.tiff 

■ 7,l,03.tiff 



7.1 



04tiff 



1.05,tffi 
l.Oe.fiff 
1.07 tff 
l.OS.tiff 
1.09,tffi 

^.Ol.tiff 
lboat512lifF 
I elaine. 512. tiff 
Igray21 512.tiff 
I numbers. 5 12. tiff 

ruler 512 Uff 
Itcstpat, Ik.tiffi 



Fig. 7: The Block Entropy Test for Encrypted Images using 100 gray image blocks at size 16-by-16 
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Table 5: The Block Entropy Test for Encrypted Images using 100 image blocks at size of 16-by-16 







Encryption Method 




Ofigi fful 


It 11/ yyi t^ii 


AES 


Two Fisli 


3DCat 


Sudolcu 


5.1.09 


5.896705* 


7.036605* 


7.017258* 


7.028879* 


7.171908 


7.180215 


5.1.10 


6.692363* 


7.033179* 


7.039004* 


7.035334* 


7.179439 


7.169024 


5.1.11 


5.544970* 


7.020790* 


7.038881* 


7.033139* 


7.182150 


7.177942 


5.1.12 


5.557432* 


7.030360* 


7.019917* 


7.038484* 


7.173553 


7.175398 


5.1.13 


1.158392* 


4.517699* 


4.942020* 


4.917323* 


7.176973 


7.186245 


5.1.14 


6.681083* 


7.039437* 


7.043030* 


7.043213* 


7.175974 


7.165637 


5.2.08 


6.017607* 


7.171057 


7.168529 


7.169126 


7.183370 


7.178135 


5.2.09 


6.228063* 


7.172360 


7.168744 


7.173990 


7.165557 


7.173511 


5.2.10 


5.045033* 


7.166008 


7.175324 


7.164280 


7.168637 


7.173879 


5.3.01 


5.923279* 


/. toy JO J 


n 1 "7in/i 1 

/.I / jy4i 


"7 1 TIOT T 
/. 1 / JZZI 


/. 1 /Dojy 


/.I /U3 / / 


J.J.UZ 


J.OZOOJ J 


7.174636 


7.174182 


7. 170160 


7.172147 


7.177803 


7.1.01 


5 956613* 

^ . ZjhJ Kjyj I ^ 


7 177397 


7 168727 




7 146194* 


7 176737 


7.1.02 


3.130283* 


7.163421 


7.167083 


7.163486 


7.182047 


7.182979 


7.1.03 


5.01571 1* 


7.163324 


7.175095 


7.172171 


7.170552 


7.173915 


7.1.04 


5.233899* 


7.164166 


7.166298 


7.166104 


7.141284* 


7.181730 


7.1.05 


5.990831* 


7.173422 


7.168685 


7.113663* 


7.169440 


7.176741 


7.1.06 


6.101809* 


7.166029 


7.164576 


7.167572 


7.171974 


7.168835 


7.1.07 


5.534905* 


7.161739* 


7.171792 


7.167448 


7.165520 


7.171042 


7.1.08 


4.268606* 


7.167514 


7.172741 


7.167774 


7.178153 


7.182649 


7.1.09 


5.543805* 


7.164298 


7.164665 


7.164676 


7.181045 


7.177071 


7.1.10 


5.366133* 


7.164842 


7.172609 


7.166904 


7.175036 


7.174440 


7.2.01 


4.724605* 


7.183806 


7.169110 


7.167013 


7.172266 


7.172823 


boat.512 


6.165926* 


7.159163* 


7.174200 


7.166788 


7.176104 


7.174827 


elaine.512 


6.246007* 


7.166420 


7.161446* 


7.161411* 


7.168059 


7.174350 


gray21.512 


1.949937* 


5.208080* 


5.392334* 


5.455673* 


7.165595 


7.199380 


numbers.512 


5.898473* 


7.159820* 


7.168180 


7.173836 


7.173024 


7.167303 


ruler.512 


0.330469* 


2.132499* 


2.468986* 


2.562190* 


7.175261 


7.187348 


testpat.lk 


1.625584* 


4.323696* 


4.779638* 


4.781003* 


7.173987 


7.192987 


Statistics 


Original 


BlowFish 


AES 


TwoFish 


3DCat 


Sudoku 


Average 


4.9627633737 


6.6975405565 


6.7488211774 


6.7511953801 


7.1718531782 


7.177268703 


Std 


1.7133301636 


1.1895800576 


1.0726741341 


1.0564646259 


0.0093951696 


0.0075774206 


# Rejection ^Hq 


28 


12 


10 


11 


2 






5. Conclusion 
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In this paper, the block entropy test for image encryption is proposed. Unlike the conventional global entropy test 
for image encryption, it measures the sample mean Hk of information entropies for K non-overlapped image blocks 
within a test image, then compare this with reference theoretical values to conclude whether the test image is 
ideally encrypted. Therefore, it has a better ability to measure the randomness of local image blocks within a test 
image and gives more reliable randomness measures than the global entropy test. In this way, the block entropy test 
contains all four desired properties for testing image randomness. 

The theoretical mean fiH'^ and variance cr^. of Hk are derived from the ideally encrypted image/true random image 
model. This assumption states that the random variable of any pixel's intensity follows a discrete uniform distribution 
on [0, L - 1] for an ideally encrypted image, where L is the number of allowed intensity scales related to the image 
format. As a result, the quantitative test result can be obtained by comparing the actual test Hx with theoretical mean 

Moreover, an a-level of significance test is also derived. As a result, the qualitative test result becomes to check 
whether or not the test Hk is below the critical value He associated with the a-level of significance. The upper bound 
of Type I error y for the proposed hypothesis test is given by using the BET, for the case when the sample size K in 
test is insufficiently large. 

In the application section, two examples are shown. The first example focuses on quantitatively measuring the 
randomness of scrambled images using the block entropy test. Results show that the block entropy scores for test 
images match randomness extents given by human visual inspections. In contrast, the conventional FIPS 140-2 ran- 
domness tests fail to give 'reasonable' randomness scores for the same set of images. This implies that the block 
entropy test is effective and meaningful in measuring image randomness quantitatively. The second example con- 
centrates on qualitatively testing whether encrypted images are random-like. Gray images from the USC-SIPI image 
data set are used in simulation, because these images covers a wide range of contents, textures, types etc. Simulation 
results of the block entropy test for five image ciphers show that the block ciphers for binary data are inappropriate 
for image data because their quantitative //joo are a way lower than the theoretical mean yUH^^ for many test images. 
Furthermore, the qualitative results of block ciphers for binary data are very poor as well. In contrast, image ciphers 
'3Dcat' and 'Sudoku' performance much better Especially noteworthy, the 'Sudoku' image cipher is the only test 
cipher that always generates random-like ciphertext images. These results show that the block entropy test is effective 
and robust. 
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